62da23d7b4078e960bd6d7845f91be6b94d9bc07837af1e6dea7040d18a93cb5

General

Target
62da23d7b4078e960bd6d7845f91be6b94d9bc07837af1e6dea7040d18a93cb5.apk
Size 18.4MB
Sample260820-mf1ewaam3y
SHA256 62da23d7b4078e960bd6d7845f91be6b94d9bc07837af1e6dea7040d18a93cb5
MD5 5e98e5851b420fe117b4bc5b446dc6eb
SHA1 719093379e5ac2d58e8b765cf5b5b4d016413a50
SHA512 aeaff9bda8331eebbdee798931f51d9d619b15facd698c63c87d0f55ffe1109d4456759ef385c1404b30632a09450c0f34ff8ff51b4f31d85e785fb452cf4124
SSDEEP 393216:W6ss0u9beizKbAfTzvgFTswj9P8adPwKd0kuJ80QHJtw9PVEMJb:W5svKaHgz5kaFy8JL2EG
TLSH
T1931712CAF72CFB1EC8369037C8AA9232755A0D128A8297F36604770C39B75E55F45BC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  62da23d7b4078e960bd6d7845f91be6b94d9bc07837af1e6dea7040d18a93cb5.apk
- Size 18.4MB
- SHA256 62da23d7b4078e960bd6d7845f91be6b94d9bc07837af1e6dea7040d18a93cb5
- MD5 5e98e5851b420fe117b4bc5b446dc6eb
- SHA1 719093379e5ac2d58e8b765cf5b5b4d016413a50
- SHA512 aeaff9bda8331eebbdee798931f51d9d619b15facd698c63c87d0f55ffe1109d4456759ef385c1404b30632a09450c0f34ff8ff51b4f31d85e785fb452cf4124
- SSDEEP 393216:W6ss0u9beizKbAfTzvgFTswj9P8adPwKd0kuJ80QHJtw9PVEMJb:W5svKaHgz5kaFy8JL2EG
- TLSH
  T1931712CAF72CFB1EC8369037C8AA9232755A0D128A8297F36604770C39B75E55F45BC9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

9^/10

defense_evasion discovery dropper evasion execution impact obfuscated persistence collection credential_access
- Encrypted or packed staged payload inside Android package
  Extracted asset shows near-random entropy without a recognised container header, indicating an encrypted secondary payload staged for runtime decryption and loading. Correlate with any runtime class-loading detection on the same sample.
  obfuscated dropper
- Checks if the Android device is rooted.
  defense_evasion
- Loads dropped Dex/Jar
  Runs executable file dropped to the device during analysis.
  evasion
- Obtains sensitive information copied to the device clipboard
  Application may abuse the framework's APIs to obtain sensitive information copied to the device clipboard.
  collection credential_access impact
- Queries information about running processes on the device
  Application may abuse the framework's APIs to collect information about running processes on the device.
  discovery
- Acquires the wake lock
- Queries information about active data network
  discovery
- Queries the mobile country code (MCC)
  discovery
- Reads information about phone network operator.
  discovery
- Checks the presence of a debugger
  defense_evasion
- Listens for changes in the sensor environment (might be used to detect emulation)
  defense_evasion
behavioral1 behavioral2 behavioral3